Details of VAR-202110-1321

ID

VAR-202110-1321

CVE

CVE-2021-42299

TITLE

Microsoft Surface Pro 3 Vulnerabilities that bypass security functions in

Trust: 0.8

sources: JVNDB: JVNDB-2021-003474

DESCRIPTION

Microsoft Surface Pro 3 Security Feature Bypass Vulnerability

Trust: 2.25

sources: NVD: CVE-2021-42299 // JVNDB: JVNDB-2021-003474 // CNVD: CNVD-2021-88729 // VULMON: CVE-2021-42299

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-88729

AFFECTED PRODUCTS

vendor:	microsoft	model:	surface pro 3	scope:	eq	version:	-	Trust: 1.0
vendor:	マイクロソフト	model:	microsoft surface pro 3	scope:	eq	version:	-	Trust: 0.8
vendor:	microsoft	model:	surface pro	scope:	eq	version:	3	Trust: 0.6

sources: CNVD: CNVD-2021-88729 // JVNDB: JVNDB-2021-003474 // NVD: CVE-2021-42299

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2021-42299
value:	MEDIUM
Trust: 1.8
secure@microsoft.com:	CVE-2021-42299
value:	MEDIUM
Trust: 1.0
CNVD:	CNVD-2021-88729
value:	LOW
Trust: 0.6
CNNVD:	CNNVD-202110-1212
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2021-42299
value:	LOW
Trust: 0.1

NVD:
severity:	LOW
baseScore:	3.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	4.9
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	FALSE
version:	2.0
Trust: 1.0
NVD:	CVE-2021-42299
severity:	LOW
baseScore:	3.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.9
CNVD:	CNVD-2021-88729
severity:	LOW
baseScore:	3.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

NVD:
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	0.9
impactScore:	4.7
version:	3.1
Trust: 1.0
secure@microsoft.com:
baseSeverity:	MEDIUM
baseScore:	5.6
vectorString:	CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N
attackVector:	PHYSICAL
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	0.4
impactScore:	4.7
version:	3.1
Trust: 1.0
NVD:	CVE-2021-42299
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2021-88729 // VULMON: CVE-2021-42299 // JVNDB: JVNDB-2021-003474 // NVD: CVE-2021-42299 // NVD: CVE-2021-42299 // CNNVD: CNNVD-202110-1212

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Bad authentication (CWE-863) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-003474 // NVD: CVE-2021-42299

TYPE

security feature problem

Trust: 0.6

sources: CNNVD: CNNVD-202110-1212

CONFIGURATIONS

sources: NVD: CVE-2021-42299

PATCH

title:	Microsoft Surface Pro 3 Security Feature Bypass Vulnerability Security Update Guide	url:	https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2021-42299	Trust: 0.8
title:	Patch for Microsoft Surface Hub security feature issue vulnerability	url:	https://www.cnvd.org.cn/patchinfo/show/299756	Trust: 0.6
title:	Microsoft Surface Hub Fixing measures for security feature vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=166681	Trust: 0.6
title:	-	url:	https://github.com/shannonmullins/hopp	Trust: 0.1
title:	-	url:	https://github.com/google/security-research	Trust: 0.1
title:	BleepingComputer	url:	https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-surface-pro-3-tpm-bypass-with-public-exploit-code/	Trust: 0.1
title:	BleepingComputer	url:	https://www.bleepingcomputer.com/news/microsoft/microsoft-issues-advisory-for-surface-pro-3-tpm-bypass-vulnerability/	Trust: 0.1

sources: CNVD: CNVD-2021-88729 // VULMON: CVE-2021-42299 // JVNDB: JVNDB-2021-003474 // CNNVD: CNNVD-202110-1212

EXTERNAL IDS

db:	NVD	id:	CVE-2021-42299	Trust: 3.1
db:	JVNDB	id:	JVNDB-2021-003474	Trust: 0.8
db:	CNVD	id:	CNVD-2021-88729	Trust: 0.6
db:	CS-HELP	id:	SB2021101908	Trust: 0.6
db:	CNNVD	id:	CNNVD-202110-1212	Trust: 0.6
db:	VULMON	id:	CVE-2021-42299	Trust: 0.1

sources: CNVD: CNVD-2021-88729 // VULMON: CVE-2021-42299 // JVNDB: JVNDB-2021-003474 // NVD: CVE-2021-42299 // CNNVD: CNNVD-202110-1212

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2021-42299	Trust: 2.0
url:	https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2021-42299	Trust: 1.7
url:	https://www.ipa.go.jp/security/ciadr/vul/20211013-ms.html	Trust: 0.8
url:	https://www.jpcert.or.jp/at/2021/at210045.html	Trust: 0.8
url:	https://msrc.microsoft.com/update-guide/vulnerability/cve-2021-42299	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2021101908	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/863.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-surface-pro-3-tpm-bypass-with-public-exploit-code/	Trust: 0.1

sources: CNVD: CNVD-2021-88729 // VULMON: CVE-2021-42299 // JVNDB: JVNDB-2021-003474 // NVD: CVE-2021-42299 // CNNVD: CNNVD-202110-1212

CREDITS

Chris Fenner of Google

Trust: 0.6

sources: CNNVD: CNNVD-202110-1212

SOURCES

db:	CNVD	id:	CNVD-2021-88729
db:	VULMON	id:	CVE-2021-42299
db:	JVNDB	id:	JVNDB-2021-003474
db:	NVD	id:	CVE-2021-42299
db:	CNNVD	id:	CNNVD-202110-1212

LAST UPDATE DATE

2023-12-18T13:17:42.063000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-88729	date:	2021-11-18T00:00:00
db:	VULMON	id:	CVE-2021-42299	date:	2023-08-01T00:00:00
db:	JVNDB	id:	JVNDB-2021-003474	date:	2021-10-28T02:36:00
db:	NVD	id:	CVE-2021-42299	date:	2023-08-08T14:22:24.967
db:	CNNVD	id:	CNNVD-202110-1212	date:	2021-10-28T00:00:00

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-88729	date:	2021-11-18T00:00:00
db:	VULMON	id:	CVE-2021-42299	date:	2021-10-20T00:00:00
db:	JVNDB	id:	JVNDB-2021-003474	date:	2021-10-28T00:00:00
db:	NVD	id:	CVE-2021-42299	date:	2021-10-20T22:15:07.833
db:	CNNVD	id:	CNNVD-202110-1212	date:	2021-10-12T00:00:00